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L9: Entry 2 of 3 



File: USPT 



Aug 1, 2001 



DOCUMENT-IDENTIFIER: US 6272113 Bl 

TITLE: Network controller system that uses multicast heartbeat packets 



Detailed Description Text (6) : 

As described more fully below, each of the NICs 122 enables the computer system to 
communicate with other devices on a corresponding network. The computer system 100 
may be coupled to at least as many networks as there are NICs 122, or two or more 
of the NICs 122 may be coupled to the same network via a common network device, 
such as a hub or a switch. When multiple NICs 122 are coupled to the same network, 
each provides a separate and redundant link to that same network for purposes of 
fault tolerance or load balancing, otherwise referred to as load sharing. Each of 
the NICs 122, or Nl -N4, preferably communicate using packets, such as Ethernet. TM. 
packets or the like. As known to those skilled in the art, a destination and source 
address is included near the beginning of each Ethernet. TM. packet, where each 
address is at least 48 bits for a corresponding media access control (MAC) address. 
A directed or unicast packet includes a specific destination address rather than a 
multicast or broadcast destination. A broadcast bit is set for broadcast packets, 
where the destination address are all ones (I's). A multicast bit in the 
destination address is set for multicast packets. 

Detailed Description Text (17) : 

FIG. 5 is a block diagram illustrating one embodiment in which the intermediate 
driver 310 defines a Heartbeat Multicast Address (HMC) and where the intermediate 
driver 310 causes each NIC team member to register the HMC address. Upon power-up, 
boot or initialization, the 0/S 301 starts each of the NIC drivers D1-D4 and the 
intermediate driver 310. The intermediate driver 310 detects and collects any and 
all multicast addresses (not shown) supported by each supported higher level 
protocol, such as the TCP/IP 302, IPX 304 and NetBEUI 306, and appends its own 
multicast address (es), which includes the HMC address. The intermediate driver 310 
then requests that each NIC driver D1-D4 register the list of multicast addresses, 
including the HMC address. As shown in FIG. 5, each NIC driver D1-D4 and the 
corresponding NICs N1-N4 are programmed to detect the single node address A and the 
HMC address. It is noted that although only the HMC address is shown, each NIC 
driver D1-D4 may be programmed with a table of multicast addresses. The 
intermediate driver 310 also includes heartbeat logic 502 that includes memory for 
storing the HMC address and a status table 504 that maintains the status of each of 
the ports P1-P4 (including the NIC drivers D1-D4 and the NICs N1-N4) of the team. 
The intermediate driver 310 also includes a timer or timer logic 506 that 
determines the heartbeat period for checking the status of the ports P1-P4. The 
heartbeat period is referred to as the HEARTBEAT__TIMER_SPEED. 
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L3: Entry 1 of 1 



File: USPT 



Jul 15, 2003 



DOCUMENT-IDENTIFIER: US 6594 776 Bl 

TITLE: Mechanism to clear MAC address from Ethernet switch address table to enable 
network link fail-over across two network segments 

Abstract Text (1) : 

There is provided a communication network and method for enhancing server 
availability to client PCS which includes two Ethernet switches. Each one of the 
two Ethernet switches is connected to a corresponding one of the primary and 
secondary network interface cards in the file server PC. The two Ethernet switches 
are interconnected together through an uplink port. As a result, redundancy has 
been effectively and efficiently provided against the failure of either one of the 
two switches in order to enable link fail-over across two network segments. 



Current US Original Classification (1) : 
714/4 
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L9: Entry 1 of 3 



File: USPT 



Jul 15, 2003 



DOCUMENT-IDENTIFIER: US 6594776 Bl 

TITLE: Mechanism to clear MAC address from Ethernet switch address table to enable 
network link fail-over across two network segments 



Brief Summary Text (6) : 

A primary link or cable 18 has its one end 20 coupled to a first or primary network 
interface card (NIC) mounted within the file server PC 14 and its other end 22 
connected to the Ethernet switch 16. In order to enhance network link availability, 
a secondary link or cable 24 is provided which has its one end 26 coupled to a 
second or redundant network interface card ( NIC ) in the file server PC and its 
other end 28 connected to the Ethernet switch 16. Under normal operation, the file 
server PC 14 uses the primary NIC and the primary link 18 to transmit and receive 
traffic. When the primary NIC fails and is unable to transfer data packets over the 
primary link 18 and the switch 16 to the client PCS, the redundant NIC will take 
over and is placed into service for performing the data transfer over the secondary 
link 24 and the switch 16. This operation is seamless and does not effect the 
normal network operation. When the primary NIC comes back on, the traffic is 
automatically switched from the secondary NIC/link 24 to the primary NIC/link 18. 

Detailed Description Text (2) : 

Referring now in detail to the drawings, there is shown in FIG. 2 a graphical 
representation of a net-worked client-server computer system 110 for enhancing 
server availability to client PCS, constructed in accordance with the principles of 
the present invention. The client-server computer system 110 includes a plurality 
of client personal computers (PCS) 112a-112e which communicate with a file server 
PC 114 so as to access shared resources. The server PC 114 has mounted therein 
first (primary) and second (default or redundant ) network interface cards ( NIC ) 
configured as a fail-over pair. Both the primary NIC and the secondary NIC are 
programmed with a single, common media access control (MAC) address which is used 
to identify the server PC 114. 

Detailed Description Text (4 ) : 

In the normal operating condition, the Ethernet switch A (124) has initially stored 
in its address table the MAC address of the primary NIC. Therefore, the client PC 
112a, for example, is able to be connected to the file server PC 114, In the event 
that the primary link 118 connected to the primary NIC should malfunction or fail, 
such as the cable or link being disconnected and/or the switch 124 failing, the 
secondary NIC will then take over. Further, the switch A (124) will delete the MAC 
address of the server PC 114 from its address table. As a result, the secondary NIC 
will send an LLC broadcast packet to the switch B (132) . 

Detailed Description Text (6) : 

Now if the primary link or cable 118 is re-connected or reinstated and/or the 
primary switch 124 is restored, the server PC software will switch control from the 
secondary NIC to the primary NIC. However, due to the fact that the secondary NIC 
remains connected to the backup Ethernet switch B (132) through the secondary link 
or cable 128, the backup switch B would still continue to have the MAC address of 
the server PC 114 stored in its address table . As a result, if the client PC 112a 
were connected to the backup switch B (132) it would not be able to be connected to 
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the server PC 114 due to the fail-back process of the primary NIC. In view of this, 
when the server PC 114 completes the fail-back, the secondary NIC is also used to 
break the secondary link or cable 128 for a short period of time. In this fashion, 
the backup switch B will cause the MAC address of the server PC 114 to be deleted 
from its address table. As a consequence, the client server 112a will again be able 
to be connected to the server PC 114 via the primary switch A and the primary link 
118. 

Detailed Description Text (8) : 

In block 304, the driver monitors periodically the status of the primary link 118 
in order to determine whether there is a failure in the primary NIC, primary link, 
or switch A. If the answer is "NO", then the process goes to the block 306 where 
the primary NIC is continued to be used for sending and/or receiving of the frames 
and is looped back to the block 304. If the answer is "YES" from the block 304, the 
process will proceed to block 308 in which the driver initiates a fail-over process 
by transferring control to the secondary NIC. Upon finding that there is a failure 
in the primary link 118 to the primary NIC, the primary switch A in the block 310 
will remove the. NIC 's address from its address table . 

Detailed Description Text (9) : 

Once the fail-over process has been completed and the secondary NIC is ready to 
take over the network traffic from the primary NIC, the driver in block 312 will 
send a broadcast LLC frame using the secondary NIC to the secondary link 128 and 
the switch B. In the block 314, when the switch B receives this LLC frame, it will 
add the MAC address to its address table . In block 316, the driver will continue to 
monitor periodically the status of the primary link 118 in order to determine 
whether the primary NIC is back on-line. If the answer is "NO", then the process 
goes to the block 318 where the secondary NIC is continued to be used for sending 
and/or receiving of the frames and is looped back to the block 316. If the answer 
is "YES" from the block 316, the process will proceed to block 322 in which the 
driver initiates a fail-back process by transferring control to the primary NIC. 

Detailed Description Text (10) : 

Upon finding that the failure has been repaired, such as re-connecting of a 
disconnected cable or replacing the failed NIC with a new one (i.e., "Hot Swap" 
procedure) , in the block 322 the link pulses being transmitted from the secondary 
NIC are then turned off for a short period of time which is accomplished by 
resetting a device in the physical layer. Since the device in the physical layer 
requires a certain amount of time before re-initialization, the link pulses will be 
turned off during this time interval. This causes the secondary switch B to assume 
that the secondary link 128 has failed. As a result, the secondary switch B in 
block 324 will remove the NIC's address from its address table . 

Detailed Description Text (11) : 

Thereafter, the driver in block 326 will again send a broadcast LLC frame using the 
primary NIC to the primary link 118 and the switch A. In the block 328, when the 
switch A receives this LLC frame, it will add the MAC address to its address table 
again. Since the LLC (Logical Link Control) frame is broadcasted, the switch A 
(124) will forward the LLC frame to the switch B (130) via the uplink port 134. 
This causes the switch B to associate the server PC's MAC address with the uplink 
port 134 in its address table. As a result, if a client PC should be connected to 
the switch B, then such client PC would be caused to be connected to the server PC 
114 via the uplink port 134, the primary switch A, and the primary link 118. The 
fail-back process is completed in the End block 330. However, the overall process 
is looped back to the block 304 as indicated by the line 332 in order to repeat the 
same . 

Current US Original Classification (1) : 
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Field of Search 714/4, 11; 709/200, 

709/223. 225, 227, 239; 370/469, 386, 

395 

References Cited 
U.S. PATENT DOCUMENTS 
5,781,530 A • 7/1998 Segal 



370/220 




There is provided a communication network and method for 
enhancing server availability to client PCS which includes 
two Ethernet switches. Each one of the two Ethernet 
switches is connected to a corresponding one of the primary 
and secondary network interface cards in the file server PC. 
The two Ethernet switches are interconnected together 
through an uplink port. As a result, redundancy has been 
effectively and efficiently provided against the failure of 
either one of the two switches in order to enable link 
fail-over across two network segments. 
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Oct 5, 2004 



DOCUMENT-IDENTIFIER: US -6801949 Bl 

TITLE: Distributed server cluster with graphical user interface 



Abstract Text (1): 

A scalable, distributed, highly available, load balancing server system having 
multiple machines is provided that functions as a front server layer between a 
network (such as the Internet) and a back-end server layer having multiple machines 
functioning as Web file servers, FTP servers, or other application servers. The 
front layer machines comprise a server cluster that performs fail-over and dynamic 
load balancing for both server layers. The operation of the servers on both layers 
is monitored, and when a server failure at either layer is detected, the system 
automatically shifts network traffic from the failed machine to one or more 
operational machines, reconfiguring front-layer servers as needed without 
interrupting operation of the server system. The server system automatically 
accommodates additional machines in the server cluster, without service 
interruption. The system operates with a dynamic reconfiguration protocol that 
permits reassignment of network addresses to the front layer machines. The front 
layer machines perform their operations without breaking network communications 
between clients and servers, and without rebooting of computers. 

Detailed Description Text (98) : 

As noted above, a variety of unique server functional features are provided by a 
server cluster constructed and operated in accordance with the invention. The 
server cluster functions as a gateway and dynamically maps virtual network 
addresses, which are the network addresses available to nodes outside the gateway, 
to primary network addresses^ which correspond to the MAC hardware addresses of the 
gateway nodes. With application software in accordance with the invention, the 
machines of the gateway server cluster communicate with the network through the 
virtual addresses of the front-layer subnet and communicate with one or more 
subnets of a back-layer group of nodes, as depicted in FIG. 3. The unique server 
cluster functional features will be described next. 
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ABSTRACT 



A scalable, distributed, highly available, load balancing 
server system having multiple machines is provided that 
functions as a front server layer between a network (such as 
the Internet) and a back-end server layer having multiple 
machines fiinctioning as Web file servers, FTP servers, or 
other appUcation servers. The front layer machines comprise 
a server cluster that performs fail-over and dynamic load 
balancing for both server layers. The operation of the servers 
on both layers is monitored, and when a server failure at 
either layer is detected, the system automatically shifts 
network traffic from the failed machine to one or more 
operational machines, reconfiguring fi-ont-layer servers as 
needed without interrupting operation of the server system. 
The server system automatically accommodates additional 
machines in the server cluster, without service interruption. 
The system operates with a dynamic reconfiguration proto- 
col that permits reassignment of network addresses to the 
front layer machines. The fi-ont layer machines perform their 
operations without breaking network communications 
between cUents and serveis, and without rebooting of com- 
puters. 
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DOCUMENT- IDENTIFIER: US 6687735 Bl 

TITLE: Method and apparatus for balancing distributed applications 



Abstract Text (1) : 

An improved method and apparatus for balancing distributed applications within a 
client/server network^ such as a cable television network, is disclosed. In one 
aspect of the invention, a method of balancing the load of distributed application 
client portions (DACPs) across various server portions (DASPs) and server machines 
is disclosed. Statistics are maintained by one or more software processes with 
respect to the available resources of the servers and their loading; new process 
threads and/or distributed application server portions are allocated across the 
servers to maintain optimal system performance as client device loading increases 
or changes. In another aspect of the invention, a novel object-oriented distributed 
application software architecture employing both vertical and horizontal partitions 
and "mutable" (i.e., transportable) objects is disclosed. The mutable objects may 
reside on either the server or client portions of the distributed application while 
maintaining at least one network partition. A runtime environment adapted for the 
operation of the foregoing object-oriented distributed application, including an 
efficient message protocol useful for interprocess communication, is also 
disclosed. Methods for downloading the DACP from the servers, and scaling the DACP 
at download based on client device configuration, are further disclosed. 

Detailed Description Text (72) : 

The message protocol (MP) of the invention further assigns virtual addresses (VAs) 
to DASPs and DACPs, so that distributed application portions can move dynamically 
within the distributed application balancing system network. Servers associated 
with the distributed application balancing system network have records, for 
example, in their respective distributed application balancing system databases 706 
that contain this dynamic mapping of virtual addresses . Clients on the network are 
only given those virtual addresses necessary to their communications needs. In one 
embodiment, however, clients can discover the virtual address of other DASPs and 
DACPs by sending a query message to the server farm 708. Discovery of such virtual 
addresses may be performed for, inter alia, identifying a well known server that 
provides a specific service, or to find applications of the same type running on 
other client devices. 
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(57) 



ABSTRACT 



An improved method and apparatus for balancing disU'ib- 
uted applications within a client/server network, such as a 
cable television network, is disclosed. In one aspect of the 
invention, a method of balancing the load of distributed 
application client portions (DACPs) across various server 
portions (DASPs) and server machines is disclosed. Statis- 
tics are maintained by one or more software processes with 
respect to the available resources of the servers and their 
loading; new process threads and/or distributed application 
server portions are allocated across the servers to maintain 
optimal system performance as client device loading 
increases or changes. In another aspect of the invention, a 
novel object-oriented distributed application software archi- 
tecture employing both vertical and horizontal partitions and 
"mutable*' (i.e., transportable) objects is disclosed. The 
mutable objects may reside on either the server or client 
portions of the distributed application while maintaining at 
least one network partition. A runtime environment adapted 
for the operation of the foregoing object-oriented distributed 
application, including an efficient message protocol useful 
for interprocess communication, is also disclosed. Methods 
for downloading the DACP &om the servers, and scaling the 
DACP at download based on client device configuration, are 
further disclosed. 
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TITLE: Firewall providing enhanced network security and user transparency 



Abstract Text (1) : 

The present invention, generally speaking, provides a firewall that achieves 
maximum network security and maximum user convenience. The firewall employs 
"envoys" that exhibit the security robustness of prior-art proxies and the 
transparency and ease-of-use of prior-art packet filters, combining the best of 
both worlds. No traffic can pass through the firewall unless the firewall has 
established an envoy for that traffic. Both connection-oriented (e.g., TCP) and 
connectionless (e.g., UDP-based) services may be handled using envoys. 
Establishment of an envoy may be subjected to a myriad of tests to "qualify" the 
user, the requeste d communication, or both. Therefore, a high level of security may 
be achieved. The usual added burden of prior-art proxy systems is avoided in such a 
way as to achieve fall transparency-the user can use standard applications and need 
not even know of the existence of the firewall. To achieve full transparency, the 
firewall is configured as two or more sets of virtual hosts. The firewall is, 
therefore, "multi-homed," each home being independently configurable. One set of 
hosts responds to addresses on a first network interface of the firewall. Another 
set of hosts responds to addresses on a second network interface of the firewall. 
In one aspect, programmable transparency is achieved by establishing DNS mappings 
between remote hosts to be accessed through one of the network interfaces and 
respective virtual hosts on that interface. In another aspect, automatic 
transparency may be achieved using code for dynamically mapping remote hosts to 
virtual hosts in accordance with a technique referred to herein as dynamic DNS, or 
DDNS. 

CLAIMS : 

9. The method of claim 4, comprising the further steps of, for at least one of the 
firewalls : 

providing multiple physical computers, each configured as a plurality of virtual 
hosts, a first virtual host on one of said physical machines being identically 
configured as a second virtual host on another of said physical machines; 

wherein said mapping from a name of the second computer to a network address of one 
of the virtual hosts of the firewall is made dynamically to one of said first 
virtual host and said second virtual host depending on availability of said one 
physical machine and said another physical machine. 
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[57] ABSTRACT 

The present invention, generally speaking, provides a fire- 
wall that achieves maximum network security and maxi- 
mum user convenience. The firewall employs "envoys" that 
exhibit the security robustness of prior-art proxies and the 
transparency and ease-of-use of prior-art packet filters, com- 
bining the best of both worlds. No traflSc can pass through 
the firewall unless the firewall has established an envoy for 
that traffic. Both connection-oriented (e.g., TCP) and con- 
nectionless (e.g., UDP-based) services may be handled 
using envoys. Establishment of an envoy may be subjected 
to a myriad of tests to "qualify" the user, the requested 
communication, or both. Therefore, a high level of security 
may be achieved. The usual added burden of prior-art proxy 
systems is avoided in such a way as to achieve fall 
transparency-the user can use standard applications and need 
not even know of the existence of the firewall. To achieve 
full transparency, the firewall is configured as two or more 
sets of virtual hosts. The firewall is, therefore, "multi- 
homed," each home being independently configurable. One 
set of hosts responds to addresses on a first network interface 
of the firewall. Another set of hosts responds to addresses on 
a second network interface of the firewall. In one aspect, 
programmable transparency is achieved by establidiing 
DNS mappings between remote hosts to be accessed through 
one of the network interfaces and respective virtual hosts on 
that interface. In another aspect, automatic transparency may 
be achieved using code for dynamically mapping remote 
hosts to virtual hosts in accordance with a technique referred 
to herein as dynamic DNS, or DDNS. 

21 Claims, 9 Drawing Sheets 
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TITLE: System for updating mapping or virtual host names to layer-3 address when 
multimedia server changes its usage state to busy or not busy 



Abstract Text (1) : 

A name mapper, name servers, and multimedia servers are connected to a multimedia 
manager. Each client has the name of a multimedia server, -i.e., a virtual host 
name, from which it can obtain multimedia service. The name server stores 
associations of server host names to layer-3 addresses. When a client initiates a 
multimedia session, it requests the layer-3 address of the server that corresponds 
to its server's name. The name server sends the layer-3 address of the one of the 
multimedia servers that is currently designated as corresponding to that name. The 
multimedia client stores the name-to-layer-3 address binding in it's cache. The 
multimedia client then establishes communications with the multimedia server at 
that layer-3 address and clears its cache. The dynamic name-to-layer-3 address 
binding in the name server is managed by the name mapper, which may be collocated 
with the multimedia manager or may be located on a separate server. The multimedia 
server manager collects real-time status information so that it knows the 
availability of the multimedia servers in the network . If a multimedia server, 
whose layer-3 address is presently mapped to from a virtual host name, becomes 
unable to serve additional clients, the multimedia server manager sends a message 
to the name mapper to modify the name to layer-3 address binding. The modification 
specifies an available server's layer-3 address to be bound in place of that of the 
server that became unable to serve additional clients. 

Brief Summary Text (19) : 

If a multimedia server., whose layer-3 address is presently associated with a 
virtual host name, becomes unable to serve additional clients, the multimedia 
server manager sends a messarge to the name mapper to modify the dynamic name to 
layer-3 address binding. The| modification specifies a new binding, by designating 
in the current server binding table an available server's layer-3 address in place 
of the server that became unable to serve additional clients. The name mapper then 
automatically changes the binding in the name servers. 
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[57] ABSTRACT 

A name mapper, name servers, and multimedia servers are 
connected to a multimedia manager. Each client has the 
name of a multimedia server, i.e., a virtual host name, from 
which it can obtain multimedia service. The name server 
stores associations of server host names to layer-3 addresses. 
When a client initiates a multimedia session, it requests the 
layer-3 address of the server that corresponds to its server's 
name. The name server sends the layer-3 address of the one 
of the multimedia servers that is currently designated as 
corresponding to that name. The multimedia client stores the 
name-lo-Iayer-3 address binding in it's cache. The multime- 
dia client then establishes communications with the multi- 
media server at that layer-3 address and clears its cache. The 
dynamic name-to-layer-3 address binding in the name server 
is managed by the name mapper, which may be collocated 
with the multimedia manager or may be located on a 
separate server. The multimedia server manager collects 
real-time status information so that it knows the availability 
of the multimedia servers in the network. If a multimedia 
server, whose layer-3 address is presently mapped to from a 
virtual host name, becomes unable to serve additional 
clients, the multimedia server manager sends a message to 
the name mapper to modify the name to layer-3 address 
binding. The modification specifies an available server's 
layer>3 address to be bound in place of that of the server that 
became imable to serve additional clients. 

20 Claims, 5 Drawing Sheets 
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TITLE: System for binding host name of servers and address of available server in 
cache within client and for clearing cache prior to client establishes connection 

Abstract Text ( 1 ) : 

A name mapper, name servers, and multimedia servers are connected to a multimedia 
manager. Each client has the- name of a multimedia server, i.e., a virtual host 
name, from which it can obtain multimedia service. The name server stores 
associations of server host names to layer-3 addresses. When a client initiates a 
multimedia session, it requests the layer-3 address of the server that corresponds 
to its server's name. The name server sends the layer-3 address of the one of the 
multimedia servers that is currently designated as corresponding to that name. The 
multimedia client stores the name-to-layer-3 address binding in it's cache. The 
multimedia client then establishes communications with the multimedia server at 
that layer-3 address and clears its cache. The dynamic name-to-layer-3 address 
binding in the name server is managed by the name mapper, which may be collocated 
with the multimedia manager or may be located on a separate server. The multimedia 
server manager collects real-time status information so that it knows the 
availability of the multimedia servers in the network . If a multimedia server, 
whose layer-3 address is presently mapped to from a virtual host name, becomes 
unable to serve additional clients, the multimedia server manager sends a message 
to the name mapper to modify the name to layer-3 address binding. The modification 
specifies an available server's layer-3 address to be bound in place of that of the 
server that became unable to serve additional clients. 

Brief Summary Text (19): 

If a multimedia server, whose layer-3 address is presently associated with a 
virtual host name, becomes unable to serve additional clients, the multimedia 
server manager sends a message to the name mapper to modify the dynamic name to 
layer-3 address binding. The modification specifies a new binding, by designating 
in the current server binding table an available server's iayer-3 address in place 
of the server that became unable to serve additional clients. The name mapper then 
automatically changes the binding in the name servers. 
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[57] ABSTRACT 

A name mapper, name servers, and multimedia servers are 
connected to a multimedia manager. Each client has the 
name of a multimedia server, i.e., a virtual host name, from 
which it can obtain multimedia service. The name server 
stores associations of server host names to layer-3 addresses. 
When a client initiates a multimedia session, it requests the 
laycr-3 address of the server that corresponds to its server's 
name. The name server sends the layer-3 address of the one 
of the multimedia servers that is currently designated as 
corresponding to that name. The multimedia client stores the 
name-to-lay er-3 address binding in it's cache. The multime- 
dia client then establishes communications with the multi- 
media server at that layer-3 address and clears its cache. The 
dynamic name-to-laycr-3 address binding in the name server 
is managed by the name mapper, which may be collocated 
with the multimedia manager or may be located on a 
separate server. The multimedia server manager collects 
real-time status information so that it knows the availability 
of the multimedia servers in the network. If a multimedia 
server, whose layeF-3 address is presently mapped to from a 
virtual host name, becomes imable to serve additional cli- 
ents, the multimedia server manager sends a message to the 
name m^per to modify the name to layer-3 address binding. 
The modification specifies an available server's layer-3 
address to be bound in place of that of the server that became 
imable to serve additional clients. 
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[57] ABSTRACT 

The present invention, generally speaking, provides a fire- 
wall that achieves maximum network security and maxi> 
mum user convenience. The firewall employs "envoys" that 
exhibit the security robustness of prior-art proxies and the 
transparency and ease-of-use of prior-art packet filters, com- 
bining the best of both worlds. No traffic can pass through 
the firewall unless the firewall has established an envoy for 
that traffic. Both connection-oriented (e.g., TCP) and con- 
nectionless (e.g., UDP-based) services may be handled 
using envoys. Establishment of an envoy may be subjected 
to a myriad of tests to "qualify" the user, the requested 
communication, or both, llierefore, a high level of security 
may be achieved. The usual added burden of prior-art proxy 
systems is avoided in such a way as to achieve fall 
transparency-the user can use standard applications and need 
not even know of the existence of the firewall. To achieve 
full transparency, the firewall is configured as two or more 
sets of virnial hosts. The firewall is, therefore, "multi- 
homed," each home being independently configurable. One 
set of hosts responds to addresses on a first network interface 
of the firewall. Another set of hosts responds to addresses on 
a second network interface of the firewall. In one aspect, 
programmable transparency is achieved by establishing 
DNS mappings between remote hosts to be accessed through 
one of the network interfaces and respective virtual hosts on 
that interface. In another aspect, automatic transparency may 
be achieved using code for dynamically mapping remote 
hosts to virtual hosts in accordance with a technique referred 
to herein as dynamic DNS, or DDNS. 
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